aksdb

I talk fully about software. Add appropriate nftable rules to the container network and that's it.

For me it's not even about better or worse, but about different. For them it's a nice iteration after many years, but for be it is one of the dozens of apps I use irregularly that suddenly behaves and works different and forces me to relearn things I don't have any gain from. Since each of the different apps get that treatment every once in a while, I end up having to adjust all the damn time for something else.

I would really like we could go back to functional applications being sold as is without forced updates. I do not need constant changes all the time. WinAmp hasn't changed in 20 years and still does exactly what it is supposed to. I could probably spin up an old MS Word 2000 and it would work just like it did 20 years ago.

Many modern apps however change constantly. No wonder they all lean towards subscriptions if they "have to" work on it all the time. But I, as a user, don't even want that. I want to buy the thing that does what it's supposed to and then I want it to stay that way.

Well, a big advantage of containers is, that you can isolate them pretty aggressively. So if you run a container that is supposed to serve content on a single HTTP port, expose only that port, mount no unnecessary volumes and run it on a network that blocks all outgoing traffic. Ideally the only thing left will be incoming traffic on the one port the service is supposed to serve.

Half off-topic, sorry: if you have some spare time on the weekend, you might want to take a look at nftables. AFAIK iptables is also just using nftables under the hood, so you are basically using a deprecated technology.

nftables is so much nicer to work with. In the end I have my custom rules (which are much saner to define than in iptables) in /etc/nftables.conf, then I have a very simple systemd unit:

[Unit]
Description=Restore nftables firewall rules
Before=network-pre.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/nft -f /etc/nftables.conf
ExecStop=/usr/sbin/nft flush table inet filter
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

and finally if I push updates via ansible I simply replace the file and run nft -f /etc/nftables.conf (via ansible; on-change event).

Edit: oh and as an example how the actual rules file looks like:

#!/usr/bin/nft -f

add table inet filter
flush table inet filter

table inet filter {
  chain input {
    type filter hook input priority 0;

    # allow established/related connections
    ct state {established, related} accept

    # early drop of invalid connections
    ct state invalid drop

    # allow from loopback
    iifname lo accept

    # allow icmp
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    # core services
    tcp dport {80, 443} accept comment "allow http(s)"
    udp dport 443 accept comment "allow http3"

    # everything else
    reject with icmpx type port-unreachable
  }

}

and with that I have my ipv4+6 firewall that allows pings and http

The second one gives you the necessary flashbacks to catch up if you should intend to follow the story. It also explains all the basics of the game mechanics as part of the quests.

I even heard people being surprised it's not Geralt. When they were surprised I started to question myself if I just dreamed that they announced that wayyyy back.

Or preferably: don't care about the game at all until it releases. Ignore previews or alpha demos, beta footage, gameplay trailers/teasers, etc. That way you don't build up hype that has a big chance to disappoint you. Take the game for what it is at release and either like it then or not.

Ah, good to know. Thanks!

There is some documentation in the forum about how to add new device support or where to request it. Read it and then decide what to do.

Even CD Project Red added such shit. Instead of directly launching Witcher or Cyberpunk I now have to go through a(nother) launcher now. Pointless.

Baldurs Gate 3 needed one from the beginning as well.

I don't get it.

What ZigBee Coordinator do you use? I know deconz and zigbee2mqtt have the ability to add support for new devices via config files. But that's a bit of a rabbit hole into the ZigBee protocol. They also have forums/issue trackers where one can request support for new devices.

Stalwart is 95% awesome. What holds me back is, that Mails are stored in a Database and not Maildir. Maildir is insanely trivial to backup incrementally and to restore individual mails if necessary. That currently holds me on dovecot.